OPC, Guidelines for processing personal data across borders: a transfer for processing is a use, not a disclosure (Office of the Privacy Commissioner of Canada, Guidelines for processing personal data across borders)
This rule covers a service provider working for the holder (storage, support tools). A buyer that trains its own model is not processing for the holder, so my reading is that the licence is a disclosure and needs consent; I found nothing from the OPC that says otherwise.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“A transfer for processing is a "use" of the information; it is not a disclosure. Assuming the information is being used for the purpose it was originally collected, additional consent for the transfer is not required.”
Where it was read
Also read from the same source
- OPC, Guidelines for processing personal data across borders: no ban and no adequacy list, accountability stays with the sender (Office of the Privacy Commissioner of Canada, Guidelines for processing personal data across borders)
- OPC, Guidelines for processing personal data across borders: say plainly that foreign authorities may access the data (Office of the Privacy Commissioner of Canada, Guidelines for processing personal data across borders)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide